LastPass (Disclosed Dec 2022): Vault Backups Stolen From Cloud Storage

Retrospective: this article looks back at events from December 2022, written in 2026 with the benefit of hindsight.

In August 2022, password manager LastPass disclosed that an attacker had accessed its development environment. In December 2022, it revealed that the attacker had used information from that first incident to steal backups of customer vault data from cloud storage.

How it happened

LastPass later explained a two-stage attack:

1. First incident: a software engineer's corporate laptop was compromised, giving access to the development environment, source code and technical information.
2. Second incident: the attacker targeted a senior DevOps engineer — one of only four with access to decryption keys for cloud storage backups. The attacker exploited a vulnerability in third-party media software on the engineer's home computer, installed a keylogger, captured the master password for the engineer's LastPass corporate vault, and used credentials stored there to access the cloud storage environment containing backups.

What was taken

Backups of customer vault data. Encrypted fields — passwords, notes — were protected by each user's master password. But some fields, such as website URLs, were not encrypted, and users with weak master passwords or older, lower iteration counts were more at risk of offline cracking. Security researchers later linked cryptocurrency thefts to cracked vaults.

Why it mattered

• Home devices became the attack path into production cloud storage.
• Highly privileged engineers were specifically targeted.
• Backups are production data and need equal protection.
• Disclosure that evolved over months damaged trust.

Lessons in hindsight

• Privileged access only from managed, hardened devices.
• Separate credentials for backup storage, with phishing-resistant MFA and just-in-time access.
• Immutable, separately administered backups.
• Limit the number of people with access to decryption keys, and monitor their use.